Bug 1714984 - SELinux policy (daemons) changes required for package: frr
Summary: SELinux policy (daemons) changes required for package: frr
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: frr
Version: 8.1
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Michal Ruprich
QA Contact: František Hrdina
Šárka Jana
URL:
Whiteboard:
: 1776349 (view as bug list)
Depends On:
Blocks: 1657029 1726199 1776342
TreeView+ depends on / blocked
 
Reported: 2019-05-29 10:29 UTC by rhel-prp-maitai@redhat.com
Modified: 2022-11-08 10:32 UTC (History)
13 users (show)

Fixed In Version: frr-7.5.1-3.el8
Doc Type: Bug Fix
Doc Text:
.The `frr` binary files and scripts have a new location Previously, the `frr` package for managing dynamic routing stack contained its binary files and scripts in the `/usr/lib/frr` directory, which caused certain issues when applying the new targeted SELinux policy. Consequently, SELinux logged denial messages in access vector cache (AVC) and prevented `frr` from starting properly. With this update, `/usr/libexec/frr` is the new location of the `frr` binary files and scripts. As a result, SELinux applies rules for binaries and scripts in `/usr/libexec/frr` and for other `frr` libraries in `/usr/lib64/frr` separately, and no longer produces denial messages.
Clone Of:
Environment:
Last Closed: 2022-11-08 09:39:31 UTC
Type: ---
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:7560 0 None None None 2022-11-08 09:39:53 UTC

Comment 5 Milos Malik 2019-08-29 08:45:59 UTC 
If the nis_enabled boolean is switched off then following programs require a name_bind access to following ports:
nhrpd -> tcp/2610
eigrpd -> tcp/2613
pbrd -> tcp/2615
staticd -> tcp/2616
fabricd -> tcp/2618
bfdd -> udp/3784
Comment 19 Lukas Vrabec 2019-11-26 14:35:58 UTC 
*** Bug 1776349 has been marked as a duplicate of this bug. ***
Comment 25 Patrik Koncity 2021-01-26 10:04:58 UTC 
PR : https://github.com/fedora-selinux/selinux-policy/pull/547
Comment 27 Zdenek Pytela 2021-02-10 17:11:01 UTC 
Resetting ITR as further clarification from frr developers is needed.
Comment 31 RHEL Program Management 2021-04-21 07:31:15 UTC 
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.
Comment 32 Maurizio Schena 2021-07-26 11:49:14 UTC 
Reopening the BZ again as we have a new customer affected by this.
Comment 34 Zdenek Pytela 2022-06-14 16:09:18 UTC 
Switching the component to frr based on preliminary agreement with the team.
Comment 54 errata-xmlrpc 2022-11-08 09:39:31 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (frr bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7560
Note You need to log in before you can comment on or make changes to this bug.